When you say security key are you talking about hardware keys or is TOTP fine in your opinion?
I think this is still an improvement over SMS, and personally is something that risk wise I'm happier with than the idea that if I lose a yubikey or it breaks down it's game over.
Maybe this WebAuthn thing will catch on and help? fingers crossed.
The evidence says this attitude of "it's other people who get phished and not me" is pure arrogance. Practically all sophisticated security professionals can be phished with sufficiently sophisticated attacks, if the underlying system is using a phishable credential.